Overview

overview

10

Static

static

3

Order490267.exe

windows7-x64

10

Order490267.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05022025_0122_04022025_Order490267.7z

  • Size

    2.8MB

  • Sample

    250205-brbp4sslat

  • MD5

    373abc1f9c83d001dab6e09503612db2

  • SHA1

    89303e01c9ee5536d3bbebda66d06135d937bf6f

  • SHA256

    0642087b7349c02936433748a8e3aceda1a80937c900016a154e467d8bdb232f

  • SHA512

    a3c11d66bcf5b870a82a89b92b488523148f08dd59891a810f7e85877f53263562b29c7084223bd1ddb4871d7cddbf507dfe7287f0a2c880bf60733e44e546dc

  • SSDEEP

    49152:w6Ant72xlLbRX0syDlD/3IxvOKKSBKiuXn1IisLd4hXez/VaxQLRl6Dur0fbbu:w6AnpKlLbVHyl/3I7KySeZd0XezNaIlp

Score
10/10
remcosabokidiscoverypersistencerat

Malware Config

Extracted

Family

remcos

Botnet

Aboki

C2

remaboki2025.duckdns.org:56379

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-FSAI48

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      Order490267.exe

    • Size

      3.4MB

    • MD5

      778a7674813e2f1e29ccd8ed1c099b26

    • SHA1

      de6117d94e471ccc9607483e0ef3892d8a86aa87

    • SHA256

      af3e7559f7119c73c2adc41c1cf5114b0658eb4ea58a7db63e69a72930751098

    • SHA512

      242cbb5c13470873882472f2f03fa6a3afbc6adedc603197add1cf126778af8edcfd5536fccd4e5aef60697cb535be0ecfa3dca4578a9f5a0d10635bffd9cdc2

    • SSDEEP

      98304:KjXNRqFJagJ2pK4JEKB5v6auTu1L07M+c:K7W5JqJH/v6acu1Lc

    Score
    10/10
    remcosabokidiscoverypersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks